CVE-2026-93520: 
TigerVNC 脆弱性分析と緩和策

CVE-2026-93520 is a heap-based buffer overflow vulnerability in the X Keyboard Extension (XKB) of the X.org X server and XWayland, caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange. Authenticated local X clients can exploit this flaw to crash the X server or potentially execute arbitrary code in the X server's context. Affected software includes X.org X server before version 21.1.25 and XWayland before version 24.1.14. The vulnerability was reported on October 7, 2026, and published to the NVD on October 28, 2026. It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, GitHub Advisory).

The root cause is an incomplete fix regression from commit a3171732d ("xkb: Always use MAP_LENGTH keymap size"), which converted most XKB allocation functions to use MAP_LENGTH (256) but missed XkbAllocNames(). As a result, XkbAllocNames() allocates names->keys using max_key_code + 1, while ChangeKeycodeRange() performs a memset up to MAP_LENGTH. When a keymap with max_key_code < 255 is loaded (e.g., sun(type6) with max_key_code=132) and a subsequent SetMap request extends maxKeyCode to 255, the memset writes past the undersized allocation, causing a heap out-of-bounds write (CWE-787, CWE-122). The fix, committed to xkb/XKBAlloc.c, changes the allocation to use MAP_LENGTH consistently. The vulnerability was discovered by an anonymous researcher working with TrendAI Zero Day Initiative (ZDI-CAN-31941) (Red Hat Bugzilla, GitHub Advisory).

Successful exploitation allows any authenticated local X client to trigger a heap out-of-bounds write in the X server process, leading to arbitrary code execution in the X server's security context or a denial of service via crash. The confidentiality, integrity, and availability impacts are all rated High, as an attacker gaining code execution within the X server could access sensitive display data, manipulate graphical sessions, or disrupt all users relying on the X server. The scope is limited to the local system, but on multi-user systems this could enable privilege escalation or disruption of other users' graphical sessions (Red Hat Bugzilla, GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires authenticated local access to the X server, limiting the attack surface compared to network-exploitable flaws. The EPSS score is approximately 0.202%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. It was discovered through the TrendAI Zero Day Initiative (ZDI-CAN-31941) (Red Hat Bugzilla, GitHub Advisory).

1. Reconnaissance: Identify a target system running X.org X server before version 21.1.25 or XWayland before 24.1.14 with local user access to an X session.
2. Authenticate to X server: Obtain a valid X client connection (e.g., via a local user account with access to the X display, typically DISPLAY=:0).
3. Load a keymap with a small max_key_code: Send an XKB request to load a keycodes component with max_key_code < 255 (e.g., sun(type6) with max_key_code=132), causing XkbAllocNames() to allocate names->keys with an undersized buffer.
4. Trigger keycode range extension: Send a subsequent SetMap or ChangeKeycodeRange XKB request that extends maxKeyCode to 255, causing XkbChangeKeycodeRange() to memset names->keys up to MAP_LENGTH (256), writing past the end of the allocated buffer.
5. Achieve heap corruption: The out-of-bounds write corrupts adjacent heap memory, potentially enabling arbitrary code execution in the X server process or causing a denial of service crash (Red Hat Bugzilla).

• Logs: X server crash logs or core dumps in /var/log/Xorg.0.log or systemd journal entries showing X server process termination; error messages related to XKB or keycode range operations.
• Process: Unexpected child processes spawned by the X server process (e.g., shells or network tools) if code execution is achieved; repeated X server restarts (e.g., via display manager logs in /var/log/gdm/ or /var/log/lightdm/).
• File System: Unexpected files written to directories accessible by the X server user (e.g., /tmp, X server home directory); new or modified files in X server configuration directories.
• Network: Unusual outbound connections from the X server process if a reverse shell payload is executed post-exploitation.

Upgrade X.org X server to version 21.1.25 or later, and XWayland to version 24.1.14 or later, which contain the one-line fix in xkb/XKBAlloc.c (commit b941a473e06f26a407a9adb15759be79f7418e86). Red Hat has issued multiple errata addressing this issue: RHSA-2026:84574 (RHEL 9), RHSA-2026:85191 (RHEL 10), RHSA-2026:85193 (RHEL 9), RHSA-2026:86907 (RHEL 8), and RHSA-2026:89747 (RHEL 8). SUSE has released SUSE-SU-2026:4636-1, SUSE-SU-2026:4645-1, SUSE-SU-2026:4663-1, and SUSE-SU-2026:4835-1. As a workaround where patching is not immediately possible, restrict local user access to X server connections and consider implementing access controls limiting which authenticated users can interact with the X Keyboard Extension (Red Hat Bugzilla, Red Hat Advisory).

The vulnerability was part of a broader batch of 12 CVEs patched in X.org Server 21.1.25 and XWayland 24.1.14, which received coverage from security news outlets including Help Net Security and Gaming on Linux, noting the significance of the release (Help Net Security, Gaming on Linux). Community discussion was moderate, with mentions on Mastodon and security aggregators. No notable individual researcher commentary specific to this CVE was identified beyond the ZDI discovery credit.